How Unique and Traceable are Usernames?

TL;DR

This paper investigates the potential of linking user profiles across online services solely based on usernames, revealing that many profiles can be connected due to username entropy, impacting privacy and anonymity.

Contribution

It introduces a novel approach to user profiling by analyzing username entropy, demonstrating that usernames alone can often link profiles across different platforms.

Findings

A significant portion of user profiles can be linked using usernames.

Username entropy correlates with the likelihood of profile linkage.

First study to consider usernames as a source for user profiling.

Abstract

Suppose you find the same username on different online services, what is the probability that these usernames refer to the same physical person? This work addresses what appears to be a fairly simple question, which has many implications for anonymity and privacy on the Internet. One possible way of estimating this probability would be to look at the public information associated to the two accounts and try to match them. However, for most services, these information are chosen by the users themselves and are often very heterogeneous, possibly false and difficult to collect. Furthermore, several websites do not disclose any additional public information about users apart from their usernames (e.g., discus- sion forums or Blog comments), nonetheless, they might contain sensitive information about users. This paper explores the possibility of linking users profiles only by looking at their usernames. The intuition is that the probability that two usernames refer to the same physical person strongly depends on the "entropy" of the username string itself. Our experiments, based on crawls of real web services, show that a significant portion of the users' profiles can be linked using their usernames. To the best of our knowledge, this is the first time that usernames are considered as a source of information when profiling users on the Internet.